1213400 - Switching list update response for initial download response causes crash

Status: VERIFIED FIXED

(Toolkit :: Safe Browsing, defect)

Description

[Matt Wobensmith [:mwobensmith][:matt:]]

1. Unzip sample files.
2. Launch pyserver13000.py 
3. Launch pyserver13001.py
4. Change Nightly Fx44 prefs for shavar list URL to "localhost:13000"
5. Change "nextupdatetime" pref to 1.
6. Relaunch Nightly via command line, using environment variables from here for debugging: https://wiki.mozilla.org/Phishing_Protection#QA

Result:
Crash - see URL

NOTE:
The fun part here is that although the Python scripts above indicate connections on ports 13000 and 13001 respectively, I simply switched them for this test. What then happens is that the initial query for table names, update interval etc. instead gets an update list response.

Comment 1

[Matt Wobensmith [:mwobensmith][:matt:]]

Attachment: crash.zip

Comment 2

[François Marier [:francois]]

Here's the reason for that crash:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffca6ff700 (LWP 367)]
mozilla::safebrowsing::ProtocolParser::ProcessChunkControl (this=0x7fffca7fb320, aLine=...) at /home/francois/devel/mozilla-central/toolkit/components/url-classifier/ProtocolParser.cpp:199
199	  if (!mTableUpdate || mTableUpdate->TableName().IsEmpty()) {
(gdb) p mTableUpdate
$1 = (mozilla::safebrowsing::TableUpdate *) 0xe4e4e4e4e4e4e4e4

De-referencing an uninitialized pointer.

Comment 3

[François Marier [:francois]]

Attachment: bug1213400.patch

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4d5314a40363

Comment 5

[François Marier [:francois]]

Comment on attachment 8693145 [details] [diff] [review]
bug1213400.patch

Approval Request Comment
[Feature/regressing bug #]: crash on invalid responses from safe browsing / tracking protection servers
[User impact if declined]: Could cause a browser crash if the trusted endpoints we use malfunction for some reason (which prevents firefox from working even in safe mode until the server is fixed).
[Describe test coverage new/current, TreeHerder]: manual testing as per Matt's steps in this bug
[Risks and why]: Prior to this, our null point checks were kind of pointless since the pointer was non-null but pointing to uninitialized memory. So theoretically, this could surface some bugs where we were using an uninitialized pointer without crashing, but it seems unlikely.
[String/UUID change made/needed]: none

Comment 6

[François Marier [:francois]]

(In reply to François Marier [:francois] from comment #5)
> [User impact if declined]: Could cause a browser crash if the trusted
> endpoints we use malfunction for some reason (which prevents firefox from
> working even in safe mode until the server is fixed).

Correction: safe-mode is not affected by this crash since all of Safe Browsing is disabled in safe-mode (see bug 1134954).

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/4d5314a40363

Comment 8

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Matt, could you please verify this issue is fixed as expected on latest Nightly? Thanks!

Comment 9

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8693145 [details] [diff] [review]
bug1213400.patch

Crash fixes are good, Aurora44+

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/3c145973b6cb

Comment 11

[Matt Wobensmith [:mwobensmith][:matt:]]

Attachment: aurora_44_crash_2015-12-04.txt

Nightly 45 looks good.

However, I'm still getting a crash on Aurora 44. See attached log. Let me know if you'd like me to do investigate more.

Comment 12

[Matt Wobensmith [:mwobensmith][:matt:]]

OK, apologies - checkin didn't happen until this morning, so perhaps I jumped the gun. I'll wait until we have a build to try it on Aurora 44. Sorry about that.

Comment 13

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-b2g44_v2_5/rev/3c145973b6cb

Comment 14

[Matt Wobensmith [:mwobensmith][:matt:]]

Verified on latest builds of both Nightly and Aurora.

Comment 15

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

(In reply to Matt Wobensmith [:mwobensmith][:matt] from comment #14)
> Verified on latest builds of both Nightly and Aurora.

This is great. Thank you!